FatalRAT

Chinese-language speakers in Southeast and East Asia were targeted with poisoned Google search results for popular applications such as the Firefox web browser, and popular messaging apps Telegram and WhatsApp, to install trojanized versions containing the FatalRAT remote access trojan.

criminals will take advantage of this through malvertising campaigns where they buy advertising space to redirect people to websites used for phishing and other undesirable activities, and malware.

Persistence Registry Run keys + scheduled tasks

FatalRAT is a C++-based implant designed to run commands and exfiltrate sensitive information back to a remote server.

After the shellcode loads and allocates memory for loading the stuffed PE modules inside svchost.txt, the execution flow will call into the first PE module found after the shellcode.

The installers are actively distributed online to trick users and increase the overall botnet infrastructure.

The criminals even told the victims that if their antivirus software detected anything, that it was a false positive alarm and to ignore it.

Initial access DLL sideloading via Sogou Input Method ( ManualNewWord.dll )

Persistence Registry Run keys + scheduled tasks

Persistence Registry Run keys + scheduled tasks

Persistence Registry Run keys + scheduled tasks

Persistence Registry Run keys + scheduled tasks

Packing VMProtect with .9990 / .9991 section naming

Users' machines are targeted via trojanized software packages masquerading as legitimate application installers.

The malware allowed for attackers to run tests that checked for virtual machines within the system before executing commands to infect the system remotely.

Initial access DLL sideloading via Sogou Input Method ( ManualNewWord.dll )

the Purple Fox group implements a customized user-mode shellcode loader that leaves little traces for cybersecurity forensics. It minimizes both the quantity and quality of the forensic evidence as the execution doesn’t rely on the native loader and doesn't respect the PE format for a successful execution.

Both implement a similar keylogging functionality, as seen in Figure 42.

Under suspected circumstances, the malware will spread on the victim’s network by brute-forcing weak passwords through IPC$.

It sends all the fingerprinting logs collected from the victim’s system... They query the registry key “HKLM\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\\"~MHz\” to identify the resources of the infected machine.

The malware allowed for attackers to run tests that checked for virtual machines within the system before executing commands to infect the system remotely.

Remote Access Tools (RATs) are software that allow users to gain access to their computer system remotely from another location... threat actors can utilize these systems to carry out malicious attacks and steal data.

If successful, the malware copies itself to the dedicated folder as %Folder%\hackshen.exe and will execute the copied file remotely.

Both implement a similar keylogging functionality, as seen in Figure 42.

It also initiates a second stage C&C channel with another set of servers. It sends all the fingerprinting logs collected from the victim’s system and then waits for new commands from the C&C server.

These packages act as a first-stage loader, triggering an infection sequence that leads to the deployment of a second-stage payload from a remote server.

This is a remote access trojan (RAT) that inherits its functionality from a malware known as FatalRAT, a sophisticated C++ RAT that implements a wide set of remote capabilities for the attackers.

C2 domains Numbered-subdomain scheme ( a1.nbdsnb2.top , a1.yydsnb1.top )

FatalRAT is a C++-based implant designed to run commands and exfiltrate sensitive information back to a remote server.

They are also trying to improve their signed rootkit arsenal for [antivirus] evasion and trying to bypass detection mechanisms by targeting them with customized signed kernel drivers.